Automatic Analysis of Open Objects in Dynamic Language Programs

Cox, Arlen; Chang, Bor-Yuh Evan; Rival, Xavier

doi:10.1007/978-3-319-10936-7_9

Cited by 21 publications

(26 citation statements)

References 34 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In this section we demonstrate the power of attribute/value trackers and desynchronized separation applied to HOO (the Heap with Open Objects Abstraction [8]) by showing key parts of the analysis of instantiating a class created by the Class library introduced in Figure 1. First we show how attribute/value trackers enhance open-object and container abstractions with the analysis of the copy function used by Class.…”

Section: Overviewmentioning

confidence: 99%

“…In this section we define attribute/value trackers and desynchronization as an extension to the heap with open objects (HOO) abstract domain [8]. First we present attribute/value trackers and how they are added to HOO.…”

Section: Abstracting Callbacks and Objects With Multi-state Abstractionmentioning

confidence: 99%

“…Because most of the JavaScript language has little effect on desynchronization or attribute value trackers, we focus on the analysis of two core commands. Other commands are either critical to HOO (loops and branches) and documented in [8] or are not critical to any of these analyses. The two core commands are:…”

Section: Analysis Using Multi-state Abstractionmentioning

confidence: 99%

“…Similarly, for each pair A i → A in M 1 and M 2 , A in the output of the join must overapproximate A i in the appropriate input to the join. The algorithm for the join is detailed in [8].…”

Section: H P J M H Pmentioning

confidence: 99%

“…When the number of variables increases (as long as there are join points), the overall analysis slows down. As in [8], nearly all of the cost can be attributed to the exponential set domain, which is implemented using binary decision diagrams. On top of this, the overhead of adding desynchronization and attribute/value trackers is negligible.…”

Section: Empirical Evaluationmentioning

confidence: 99%

See 4 more Smart Citations

Desynchronized Multi-State Abstractions for Open Programs in Dynamic Languages

Cox

Chang

Rival

2015

Programming Languages and Systems

Self Cite

View full text Add to dashboard Cite

Abstract. Dynamic language library developers face a challenging problem: ensuring that their libraries will behave correctly for a wide variety of client programs without having access to those client programs. This problem stems from the common use of two defining features for dynamic languages: callbacks into client code and complex manipulation of attribute names within objects. To remedy this problem, we introduce two state-spanning abstractions. To analyze callbacks, the first abstraction desynchronizes a heap, allowing partitions of the heap that may be affected by a callback to an unknown function to be frozen in the state prior to the call. To analyze object attribute manipulation, building upon an abstraction for dynamic language heaps, the second abstraction tracks attribute name/value pairs across the execution of a library. We implement these abstractions and use them to verify modular specifications of class-, trait-, and mixin-implementing libraries.

show abstract

Section: Overviewmentioning

confidence: 99%

Section: Abstracting Callbacks and Objects With Multi-state Abstractionmentioning

confidence: 99%

Section: Analysis Using Multi-state Abstractionmentioning

confidence: 99%

Section: H P J M H Pmentioning

confidence: 99%

Section: Empirical Evaluationmentioning

confidence: 99%

See 3 more Smart Citations

Desynchronized Multi-State Abstractions for Open Programs in Dynamic Languages

Cox

Chang

Rival

2015

Programming Languages and Systems

Self Cite

View full text Add to dashboard Cite

show abstract

Weakly sensitive analysis for JavaScript object‐manipulating programs

Rival

Ryu

2019

Softw Pract Exp

Self Cite

View full text Add to dashboard Cite

While JavaScript programs have become pervasive in web applications, they remain hard to reason about. In this context, most static analyses for JavaScript programs require precise call graph information, since the presence of large numbers of spurious callees significantly deteriorates precision. One of the most challenging JavaScript features that complicate the inference of precise static call graph information is read/write accesses to object fields, the names of which are computed at runtime. JavaScript framework libraries often exploit this facility to build objects from other objects, as a way to simulate sophisticated high-level programming constructions. Such code patterns are difficult to analyze precisely, due to weak updates and limitations of unrolling techniques. In this paper, we observe that precise field origination relations can be inferred by locally reasoning about object copies, both regarding to the object and to the program structure, and we propose an abstraction that allows to separately reason about field read/write access patterns working on different fields and to carefully handle the sets of JavaScript object fields. We formalize and implement an analysis based on this technique. We evaluate the performance and precision of the analysis on the computation of call graph information for examples from jQuery tutorials. KEYWORDSabstract interpretation, JavaScript, object abstraction, static analysis, string abstraction, trace partitioning abstractionThe results in this paper are based in part on findings presented in the proceeding of APLAS'17. 840 FIGURE 1 A simplified excerpt from jQuery 1.7.2 and an example use case [Colour figure can be viewed at wileyonlinelibrary.com]One of the problematic JavaScript features that complicate the precise static call graph construction is read/write accesses to object fields, the names of which are computed at runtime. In JavaScript, an object has a set of fields, each of which consists of a name and value pair, and the field lookup and update operations take the value of an expression as an index that designates the field to read or write. JavaScript framework libraries often exploit this facility to build an object from another object by copying all the fields one by one (shallow copy) or by computing values using the fields in the source object (eg, to simulate accessor methods). To reason over such field copy or transformation patterns (for short, FCT patterns), analysis tools need to resolve precisely the fields of objects, and the relations among them.As an example, we consider the jQuery implementation of class inheritance using field copies of an object, as shown in Figure 1. To achieve that, function fix copies the fields of oE designated by the elements of array copy into array e. This copy of the fields of object oE takes place in the loop at lines 3-7. More generally, an FCT pattern boils down to an assignment of the form o1where v is a variable, o1 and o2 are two objects, f is a function over field names, and g is a function over values. ...

show abstract

A Product of Shape and Sequence Abstractions

Giet,

Ridoux,

Rival

2023

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

Traditional separation logic-based shape analyses utilize inductive summarizing predicates so as to capture general properties of the layout of data-structures, to verify accurate manipulations of, e.g., various forms of lists or trees. However, they also usually abstract away contents properties, so that they may only verify memory safety and invariance of data-structure shapes. In this paper, we introduce a novel abstract domain to describe sequences of values of unbounded size, and track constraints on their length and on extremal values contained in them. We define a reduced product of such a sequence abstraction together with an existing shape abstraction so as to infer both shape and contents properties of data-structures. We report on the implementation of the sequence domain, its integration into a static analyzer for C code, and we evaluate its ability to verify partial functional correctness properties for list and tree algorithms.

show abstract

Automatic Analysis of Open Objects in Dynamic Language Programs

Cited by 21 publications

References 34 publications

Desynchronized Multi-State Abstractions for Open Programs in Dynamic Languages

Desynchronized Multi-State Abstractions for Open Programs in Dynamic Languages

Weakly sensitive analysis for JavaScript object‐manipulating programs

A Product of Shape and Sequence Abstractions

Contact Info

Product

Resources

About